CVE-2025-11164
Unknown Unknown - Not Provided
Unauthorized Plugin Activation in Mavix Education WordPress Theme

Publication date: 2025-12-13

Last updated on: 2025-12-13

Assigner: Wordfence

Description
The Mavix Education theme for WordPress is vulnerable to unauthorized modification of data due to a missing capability check on the 'mavix_education_activate_plugin' AJAX action in all versions up to, and including, 1.0. This makes it possible for authenticated attackers, with Subscriber-level access and above, to activate the Creativ Demo Importer plugin.
CVSS Scores
EPSS Scores
Probability:
Percentile:
Meta Information
Published
2025-12-13
Last Modified
2025-12-13
Generated
2026-06-16
AI Q&A
2025-12-13
EPSS Evaluated
2026-06-15
NVD
CVE-2025-11164
Affected Vendors & Products
Showing 1 associated CPE
Vendor Product Version / Range
wordpress mavix_education 1.0
Helpful Resources
Exploitability
CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-862 The product does not perform an authorization check when an actor attempts to access a resource or perform an action.
Attack-Flow Graph
AI Quick Actions
Instant insights powered by AI
Mitigation Strategies

To mitigate this vulnerability, you should update the Mavix Education WordPress theme to a version later than 1.0, such as version 1.1 or above, which includes code fixes and improvements. Additionally, restrict Subscriber-level users from activating plugins by reviewing user roles and permissions. Monitor and control plugin activation capabilities to prevent unauthorized activation of the Creativ Demo Importer plugin. [2]

Executive Summary

The vulnerability in the Mavix Education theme for WordPress allows authenticated users with Subscriber-level access or higher to activate the Creativ Demo Importer plugin without proper authorization. This happens because the theme lacks a capability check on the 'mavix_education_activate_plugin' AJAX action, enabling unauthorized modification of data.

Impact Analysis

This vulnerability can allow attackers with low-level access (Subscriber or above) to activate plugins they should not be able to, potentially leading to unauthorized changes in the WordPress environment. While it does not directly compromise confidentiality or availability, it can lead to unauthorized modification of data and may be used as a stepping stone for further attacks.

Chat Assistant
Ask questions about this CVE
Hi! I’m here to help you understand CVE-2025-11164. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70
EPSS Chart